We have a Cisco 2900 series switch with a port configured for "port security action shutdown" and "max-mac-count 1". It works like it's supposed to, but we ran across something strange that we can't explain:
One of the system administrators accidentally assigned a duplicate IP address to one of our host machines. Of course, the machine immediately shut off its network services and popped up an IP conflict message box; however, the switch port it was connected to (with port security configured) also shut down. When we configured the machine for the correct IP and cleared the mac on the port, it started working as it should. I did a test and changed the IP address of the machine to one that was NOT a duplicate IP and it also worked fine. Upon changing it back to a duplicate IP, though, the switch port shut down again.
Why is this happening? I understand how port security works and I realize it's a moot point either way, since a machine will shut down its network services anyway with a duplicate IP (even if the switch port doesn't). BUT, I assumed (maybe incorrectly) that the switch port tabled only the secure mac address. How is IP being thrown into this? Any answers would be appreciated.
